Privacy and fairness in a variant of Prêt-à-voter

Transcription

1 Prvacy and farness n a varant of Prêt-à-voter Ben Smyth and Mar Ryan School of Computer Scence he Unversty of Brmngham

2 Electronc votng currently Electronc votng s eagerly beng taen up by governments and other organsatons the world over. he stuaton n the USA Propretary system, wth wea securty propertes. 5 year old n garage could manufacture cards and sell them on the nternet that would allow multple votes [Av Rubn] I voted party p and the system sad `han you, we have recorded your vote for party p. (Rado phone-ns, webstes) Allegatons of nvolvement of equpment suppler wth a poltcal party he stuaton n Estona Internet votng offered to entre electorate Authentcaton by smart cards Re-votng allowed, to combat coercon

3 Desrable propertes of votng systems Desred propertes of electronc votng systems Elgblty: only elgble voters can vote, and only once. Farness: no early results can be obtaned whch could nfluence the remanng voters. Prvacy: no-one can ln a voter and her vote. Recept-freeness: no recept or other artfact s ssued whch would enable voter to prove how she voted. Coercon-resstance: a voter cannot convnce a coercer that she voted how he nstructed.

4 Desrable propertes of votng systems Some other propertes Indvdual verfablty: a voter can verfy that her vote was counted. Unversal verfablty: a voter can verfy that the publshed result s the tally of the votes cast. Robustness: Voters cannot dsrupt the electon. Faulty behavour tolerated. Vote-and-go: Voters partcpate n one sesson.

5 Prêt-à-voter A votng scheme desgned by Chaum / P.Ryan / Schneder Ballot papers have canddates lsted n a random rotaton of the offcal lst An onon encodes the offset needed to cycle bac to the correct order At vote tme, the left-hand strp s detached and destroyed he rght-hand strp s gven to the frst of a seres of ellers each one decrypts a layer of the onon and computes a component of the offset then hands t on to the next one Canddate Davd ony Menzes Carolne Arthur Put X 7rJ#94U

6 Prêt-à-voter Admnstrator Alce - -4 onon offset onon offset + v decr / subtr / mx on off decr / subtr / mx onon = g { g,{ g, D} } { }...,..., g, offset h g ) +... h( g ) mod = ( + V 3 decr / subtr / mx d / s / m v

7 Corrupt electon offcals Votng systems should be desgned to wor securely even f the electon offcals are corrupt Farness: results cannot be released before electon closes. Prvacy: no-one can ln a voter and her vote. Coercon-resstance: a voter cannot convnce a coercer that she voted how he nstructed. PaV fals to satsfy these propertes he authorty that ssues the ballot papers can reveal the vote wthout the need of the tellers (breang farness) And t can ln the ballot paper wth the publshed results (breang prvacy and coercon-resstance)

8 Fxng PaV In PaV, the onon s constructed by the authorty onon = g { g,{ g, D} } { }...,..., g, 3 he authorty can ln onon and offset, and therefore compute the vote from the nfo posted on the bulletn board. Hence prvacy (and therefore coercon-resstance) and farness fal. Even f the voter constructs the onon, coercon resstance fals. She can prove an onon (and hence a vote) s hers by demonstratng nowledge of the germs g. From these, the onon and the correspondng offset can be constructed.

9 Better fx for PaV he voter constructs an onon wth help from the tellers {g } {g } {g }... o {g } {g } {g }... o {g } {g } {g }... o 3 {g 3 } {g 3 } {g 3 }... o c c c onon = c { { { } } }..., c, c, D..., c, 3

10 Better fx for PaV No-one nows all the g j s, and no-one (except the voter) nows the offset. he voter can show the coercer how to reconstruct the onon, but she can t convnce hm about the offset. 3..., } {, } {...,, } {, } {,,, = = = = D g g g g

11 Propertes of fxed PaV Prvacy Farness Coercon-resstance holds except that the voter can prove to the last teller how she voted. (Can probably be fxed too!)

12 P.Ryan / Peacoc varant Also a soluton whch reles on dstrbutng the constructon of the ballot. so that the relaton between the ballot and the offset s not learned by any entty. Canddate Put X Canddate Put X Canddate Put X Davd ony Menzes Carolne Arthur hy7^8fg 7rJ94U hy7^8fg 7rJ94U 7rJ94U

13 Do we need prvacy and coercon-resstance In the UK? In the USA? What about Zmbabwe?